Privacy Policy

Last updated 15 November 2026

HullpinCrew (hullpincrew.com) connects yacht crew with employers. This policy explains what personal data we process, why, who can see it and what you can do about it. The data controller is [Company legal name, address, registration number]. Contact: privacy@hullpin.com.

1. What we collect

• Account: name, email address, password (stored only as a salted hash), or your Google account identifier if you sign in with Google.
• Crew profile: what you enter: position, experience, certificates, skills, languages, location, nationality, availability, links, references, phone, personal details you choose to add, your photo and your CV file.
• Employers: company name, country, website and the job posts you publish.
• Applications: which jobs you applied to, your message and the stage the employer sets.
• Security data: sign-in sessions with IP address and browser type, and counters that limit repeated sign-in attempts.

2. Why we use it (legal basis)

• To run your account and the service you asked for: profiles, job posts, applications (performance of a contract).
• To keep accounts secure and prevent abuse such as spam or password guessing (legitimate interest).
• To show your profile publicly, only if you switch it to public (consent, which you can withdraw at any time by switching it back).
• Optional usage statistics, only if you accept them in the cookie settings (consent).

We do not sell personal data and we do not use it for advertising.

3. Who can see your data

• Private profile (default): only you.
• Public profile: anyone can see your name, photo, position, experience, certificates, skills, languages, nationality, location, availability, links and the names of your references. Your email, phone, personal details, reference contact details and CV file are never shown publicly.
• When you apply to a job: that employer sees your full profile, contact details and CV. If you withdraw the application, the employer loses this access.
• Service providers that host the service for us under data processing terms: Vercel (hosting), Prisma (database), Cloudflare R2 (file storage) and Google (only if you use Google sign-in).

4. International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

We keep your data while your account exists. When you delete your account, your profile, company, job posts, applications, photo and CV are deleted immediately; backups held by our providers expire within their normal cycle. Security logs are kept for up to 90 days.

6. Your rights

You can access, correct, download (in your profile settings: “Download my data”) and delete your data (“Delete my account”), object to processing and withdraw consent. You can also complain to your data protection authority (in Turkey, the KVKK Authority; in the EU, your local supervisory authority).

7. Security

Connections are encrypted (HTTPS). Passwords are hashed, files are kept in private storage and opened only through short-lived links after an access check, photos are re-encoded to remove hidden metadata such as location, and repeated sign-in attempts are rate-limited.

8. Cookies

We only use cookies that the service needs to work, plus optional ones you can accept or refuse in the cookie banner.

Your browser also stores some preferences locally (for example draft documents and display settings); these never leave your device.

9. Changes

We will post changes here and, for important ones, tell signed-in users before they apply.